jimmykane
jimmykane/quantified-self
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/jimmykane/quantified-self --skill security-review命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Analyze one or more authorized Quantified Self activities through its read-only MCP tools. Use for individual workouts, activity summaries, canonical metrics, laps, MTB jumps, swim lengths, pace or power charts, breadcrumb traces, or finding activities near a place; use the training skill for aggregate trends across many activities.
Compare the user's authorized Quantified Self data across two or more health and fitness domains through its read-only MCP tools. Use for cross-domain questions such as sleep versus training, weight versus activity, or recovery trends that require combining measurements, Training metrics, sleep, activities, or routes; use the focused Quantified Self skills for single-domain requests or multiple independent summaries that do not need comparison.
Analyze the user's authorized Quantified Self sleep data through its read-only MCP tools. Use for sleep sessions, duration, stages, efficiency, naps, bedtime or wake-time patterns, HRV, sleep heart rate, blood oxygen, respiration, and sleep-oriented recovery trends; use the cross-domain Quantified Self skill when comparing sleep with training, measurements, or activities.
基于 SOC 职业分类
正在显示 SKILL.md
| name | security-review |
| description | Review Firebase Security Rules and Angular application security patterns |
Perform security audits focusing on Firebase Security Rules and Angular application security.
# Validate Firestore rules syntax
firebase deploy --only firestore:rules --dry-run
# Run Firestore rules tests
npm run test:rules
firestore.rulessrc/firestore.rules.spec.ts| Issue | Risk | Check |
|---|---|---|
| Missing auth check | HIGH | Every rule should check request.auth != null |
| Overly permissive writes | HIGH | Validate data shape on writes |
| Missing resource ownership | HIGH | Verify request.auth.uid == resource.data.userId |
| Read-only fields modified | MEDIUM | Use !('fieldName' in request.resource.data.diff(resource.data)) |
| Unbounded list queries | MEDIUM | Add limits to collection reads |
[ ] All collections require authentication
[ ] Users can only access their own data (uid check)
[ ] Admin operations check custom claims
[ ] Write operations validate data structure
[ ] Sensitive fields cannot be modified after creation
[ ] Delete operations are appropriately restricted
# Start emulator and run rules tests
npm run test:rules
# Or manually:
npx firebase emulators:exec --project demo-test --only firestore 'npx vitest run --config vitest.rules.config.ts'
| Pattern | Location |
|---|---|
| Route guards | src/app/authentication/ |
| Pro-only directive | src/app/directives/pro-only.directive.ts |
| Has-role directive | src/app/directives/has-role.directive.ts |
[ ] No hardcoded API keys in source code
[ ] Environment files excluded from git
[ ] Firebase App Check enabled
[ ] CORS configured correctly on Cloud Functions
[ ] User input sanitized before storage
[ ] Error messages don't leak sensitive info
When performing a security review, document findings using this format:
## Security Review: [Feature/Component]
### Scope
- Files reviewed: [list]
- Rules affected: [list]
### Findings
#### [CRITICAL/HIGH/MEDIUM/LOW] - Issue Title
- **Location**: `file:line`
- **Issue**: Description
- **Risk**: Potential impact
- **Recommendation**: How to fix